CVE-2026-101983: CWE-121 Stack-based Buffer Overflow in Juniper Networks Junos OS

This vulnerability (CVE-2026-101983) is a stack-based buffer overflow in the httpd process of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated attacker can exploit this flaw remotely via a J-Web virtual-domain configuration to execute arbitrary code or cause a denial of service. The vulnerability affects multiple versions across Junos OS and Junos OS Evolved, specifically versions >=23.4 and <23.4R2-S8.13, >=24.2 and <24.2R2-S5.5, >=24.4 and <24.4R2-S5, >=25.2 and <25.2R2-S2, >=25.4 and <25.4R1-S3, >=26.2 and <26.2R1-S2, and corresponding versions for the Evolved and X-series variants. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code or cause a denial of service on affected Junos OS devices. This compromises the confidentiality, integrity, and availability of the system, potentially leading to full system compromise and disruption of network services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor Juniper Networks advisories closely and apply updates or mitigations as soon as they become available. Until then, consider limiting network exposure of the J-Web virtual-domain service to trusted networks only.